Retention Impact Assess

PURPOSE-BASED RETENTION ANALYSIS
---------------------------------

Purpose 1: [Primary processing purpose]
- Legal basis: [Art. 6(1)(x)]
- Data categories needed: [List]
- Duration of purpose: [How long does this purpose persist?]
- Retention period for this purpose: [Duration]
- Justification: [Why this period is necessary and proportionate]

Purpose 2: [Secondary processing purpose — if any]
- Legal basis: [Art. 6(1)(x)]
- Data categories needed: [List — should be subset of or equal to Purpose 1]
- Duration of purpose: [How long does this purpose persist?]
- Retention period for this purpose: [Duration]
- Justification: [Why this period is necessary and proportionate]

Statutory Override (if applicable):
- Statute: [Citation]
- Mandatory minimum: [Period]
- This overrides Purpose [X] period: [Yes/No]

RESULTING RETENTION PERIOD: [The longest justified period across all purposes
and statutory requirements, but no longer than the maximum necessary period]

PROPORTIONALITY ASSESSMENT
----------------------------

1. NECESSITY
   - Is the proposed retention period the minimum necessary to achieve
     the stated purpose(s)? [Yes/No — justify]
   - Could the purpose be achieved with a shorter retention period?
     [Yes/No — justify]
   - Could the purpose be achieved with anonymized or aggregated data
     after a shorter period of identifiable retention? [Yes/No — justify]

2. DATA MINIMIZATION OVER TIME
   - Can some data elements be deleted or anonymized before the full
     retention period expires? [Yes/No — if yes, specify staged deletion]
   - Example: Full data retained for 12 months for service delivery;
     anonymized to aggregate statistics at 12 months; aggregates retained
     for 3 years for trend analysis.

3. ACCESS RESTRICTION OVER TIME
   - Should access be progressively restricted as the data ages?
   - Example: Active access for first 12 months; restricted to compliance
     team only for months 13-72; automated deletion at month 72.

4. RISK TO DATA SUBJECTS
   - What is the risk to data subjects from the proposed retention?
     [Low/Medium/High — justify]
   - Does longer retention increase breach impact? [Yes/No]
   - Are there specific data subject groups requiring heightened protection?
     (e.g., children, vulnerable individuals)

5. ALTERNATIVES TO RETENTION
   - Has anonymization been considered as an alternative? [Yes/No — outcome]
   - Has pseudonymization been considered to reduce risk during retention?
     [Yes/No — outcome]
   - Has data aggregation been considered? [Yes/No — outcome]

PROPORTIONALITY CONCLUSION:
The proposed retention period of [X] is / is not proportionate because:
[Detailed justification — 2-3 paragraphs]

RETENTION PERIOD RECOMMENDATION
---------------------------------

Data Category: [Description]
Processing Activity: [Name]

RECOMMENDED RETENTION STRUCTURE:
┌──────────────────────┬─────────────────────┬──────────────────────────────┐
│ Phase                │ Duration            │ Data State                   │
├──────────────────────┼─────────────────────┼──────────────────────────────┤
│ Active processing    │ [Duration]          │ Full data, full access       │
│ Passive retention    │ [Duration]          │ Full data, restricted access │
│ Reduced retention    │ [Duration]          │ Minimized data, restricted   │
│ Anonymized retention │ [Duration/indefinite]│ Anonymized, no restrictions  │
│ Deletion             │ At end of above     │ Permanent deletion           │
└──────────────────────┴─────────────────────┴──────────────────────────────┘

Total identifiable retention period: [Sum of active + passive + reduced]
Retention trigger: [Event that starts the retention clock]
Deletion method: [Automated / Manual / Anonymization]

JUSTIFICATION SUMMARY:
[Concise summary of legal basis, statutory requirements, purpose analysis,
 and proportionality conclusion supporting this recommendation]

APPROVED BY:
- Business Owner: [Name] — Date: [YYYY-MM-DD]
- DPO: [Name] — Date: [YYYY-MM-DD]
- Legal (if statutory retention involved): [Name] — Date: [YYYY-MM-DD]

RIA REGISTER — Orion Data Vault Corp (Extract)

┌──────────────┬──────────────────────────┬────────────┬───────────────┬──────────────┬─────────────┐
│ RIA Ref      │ Processing Activity      │ Date       │ Retention     │ Status       │ Next Review │
│              │                          │ Completed  │ Period        │              │             │
├──────────────┼──────────────────────────┼────────────┼───────────────┼──────────────┼─────────────┤
│ RIA-2025-012 │ Customer loyalty program  │ 2025-06-15 │ Membership +  │ Active       │ 2026-06-15  │
│              │                          │            │ 2 years       │              │             │
├──────────────┼──────────────────────────┼────────────┼───────────────┼──────────────┼─────────────┤
│ RIA-2025-018 │ Employee wellbeing survey │ 2025-09-01 │ 12 months     │ Active       │ 2026-09-01  │
│              │                          │            │ (anonymize    │              │             │
│              │                          │            │ at 3 months)  │              │             │
├──────────────┼──────────────────────────┼────────────┼───────────────┼──────────────┼─────────────┤
│ RIA-2026-019 │ Vendor loyalty programme   │ 2026-03-14 │ 24 months     │ In progress  │ 2028-03-14  │
│              │ analytics                │            │ (review at    │              │             │
│              │                          │            │ 12 months)    │              │             │
└──────────────┴──────────────────────────┴────────────┴───────────────┴──────────────┴─────────────┘